Orta CVSS 5.3 PoC var
CVE-2023-51764: Postfix: güvenlik açığı
Açıklama (NVD)
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
Özet bilgiler
- Ürün
- Postfix Postfix
- CVSS v3.1
- 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - EPSS
- %2,64 (yüzdelik 86)
- CWE
- CWE-345
- Yama
- Geçici çözüm
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| postfix-postfix | — | — | 3.5.23 |
| postfix-postfix | 3.6.0 | — | 3.6.13 |
| postfix-postfix | 3.7.0 | — | 3.7.9 |
| postfix-postfix | 3.8.0 | — | 3.8.4 |
| fedoraproject-fedora | 38 | 38 | — |
| fedoraproject-fedora | 39 | 39 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |
Kaynaklar
- NVD kaydı
- www.openwall.com
- www.openwall.com
- www.openwall.com
- access.redhat.com
- bugzilla.redhat.com
- fahrplan.events.ccc.de
- github.com
- github.com
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lwn.net
- sec-consult.com
- www.openwall.com
- www.postfix.org
- www.postfix.org
- www.youtube.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- access.redhat.com
- bugzilla.redhat.com
- fahrplan.events.ccc.de
- github.com
- CWE-345